CVE-2026-64064 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability, as it can cause issues with file system operations. They should take necessary precautions to protect their systems, including applying patches and monitoring system behavior.

Technical summary

The vulnerability is caused by the netfs_invalidate_folio() function not properly clearing the dirty bit when all changes are gone. This can lead to unexpected behavior when reading from a file via mmap(). The issue can be reproduced using a specific sequence of commands involving dd, umount, mount, and xfs_io. To address this, Linux kernel users should apply the patch to fix the issue, verify and update the Linux kernel to the latest version, and monitor file system operations for unexpected behavior.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch to fix the issue
• Verify and update Linux kernel to the latest version
• Monitor file system operations for unexpected behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction. The issue can be fixed by calling folio_cancel_dirty() in netfs_invalidate_folio() when all dirty data in the folio is erased. Linux kernel users should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources